A Novel Device Identification Method Based on Passive Measurement

Algorithm 2

Differ NAT-like node and host-like node.

Input: : Graph based on netflow; : List of Serve Detected from Algorithm 1;

: List of Terminal Detected from Algorithm 1; eps: Neighbor radius to form a

density area; minPts: Minimum number to form a high density area;

Output: Label of nodes: NAT or host;

1:

2: for each in do//ergodic per server

3:

4:for each in do//ergodic per terminal

5:if from to exist edge in then//belongs to undirected graph

6:Put in list //creat special terminal list about this server

7:

8:for each in do

9://time of communication between and

10://package’s number between s and l

11://total flow data between and

12:Put in list

13:

14:Running DBSCAN with eps and minPts//with dataset

15: outliers//collecting outliers with list C

16://integer found by servers

17: return N//N represent NAT, others represent Host